package org.mat.ipaas.ucenter.bff.admin.modules.system;

import javax.servlet.http.HttpServletRequest;

import org.mat.framework.lang.dto.MatApiResponse;

import org.mat.ipaas.ucenter.service.api.system.DuplicateCheckRestAPI;
import org.mat.ipaas.ucenter.service.dto.system.model.DuplicateCheckVoDTO;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;

import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import lombok.extern.slf4j.Slf4j;

/**
 * @Title: DuplicateCheckAction
 * 重复校验工具
 * @Author 张代浩
 * @Date 2019-03-25
 * @Version V1.0
 */
@Slf4j
@RestController
@RequestMapping("/sys/duplicate")
@Api(tags = "重复校验")
public class DuplicateCheckController {

    @Autowired
    private DuplicateCheckRestAPI duplicateCheckRestAPI;

    /**
     * 校验数据是否在系统中是否存在
     *
     * @return
     */
    @RequestMapping(value = "/check", method = RequestMethod.GET)
    @ApiOperation("重复校验接口")
    public MatApiResponse<String> doDuplicateCheck(DuplicateCheckVoDTO duplicateCheckVoDTO) {
        MatApiResponse<String> matApiResponse = duplicateCheckRestAPI.doDuplicateCheck(duplicateCheckVoDTO);
        return matApiResponse;
    }

    /**
     * VUEN-2584【issue】平台sql注入漏洞几个问题
     * 部分特殊函数 可以将查询结果混夹在错误信息中，导致数据库的信息暴露
     *
     * @param e
     * @return
     */
    @ExceptionHandler(java.sql.SQLException.class)
    public MatApiResponse<?> handleSQLException(Exception e) {
        String msg = e.getMessage();
        String extractvalue = "extractvalue";
        String updatexml = "updatexml";
        if (msg != null && (msg.toLowerCase().indexOf(extractvalue) >= 0 || msg.toLowerCase().indexOf(updatexml) >= 0)) {
            return MatApiResponse.fail("校验失败，sql解析异常！");
        }
        return MatApiResponse.fail("校验失败，sql解析异常！" + msg);
    }
}
